ISO-IEC-27001-LEAD-AUDITOR · Question #189
You are an experience ISMS audit team leader carrying out a third-party certification audit of an organization specialising in the secure disposal of confidential documents and removable media. Both…
The correct answer is A. Advising the individual managing the audit programme of any recommendation by you to C. Considering the need for a subsequent audit within 4 weeks based on the additional G. Verifying with the auditee that lower grade machines are used in certain circumstances. This is. According to ISO/IEC 27001:2022 clause 8.1, the organization must plan, implement and control the processes needed to meet the information security requirements, and to implement the actions determined in clause 6.1. The organization must also ensure that the outsourced…
Question
You are an experience ISMS audit team leader carrying out a third-party certification audit of an organization specialising in the secure disposal of confidential documents and removable media. Both documents and media are shredded in military grade devices which make it impossible to reconstruct the original. The audit has gone well and you are just about to start to write the audit report, 30 minutes before the closing meeting. At this point one of the organization's employees knocks on your door and asks if they can speak to you. They tell you that when things get busy her manager tells her to use a lower grade industrial shredder instead as the organisation has more of these and they operate faster. You were not informed about the existence or use of these machines by the auditee. Select three options for how you should respond to this information.
Options
- AAdvising the individual managing the audit programme of any recommendation by you to
- BCancel the production of the audit report and instead review the organization's contracts with its
- CConsidering the need for a subsequent audit within 4 weeks based on the additional
- DDo nothing. All audits are based on a sample and the sample you took did not include a planned
- EExtend the certification audit duration to create additional time to audit the use of the lower grade
- FRaise a nonconformity against 8.1 Operational Planning and Control as the organization has not
- GVerifying with the auditee that lower grade machines are used in certain circumstances. This is
How the community answered
(34 responses)- A62% (21)
- B9% (3)
- D24% (8)
- E3% (1)
- F3% (1)
Explanation
According to ISO/IEC 27001:2022 clause 8.1, the organization must plan, implement and control the processes needed to meet the information security requirements, and to implement the actions determined in clause 6.1. The organization must also ensure that the outsourced processes are controlled or influenced. According to control A.5.24, the organization must establish and maintain an information security incident management process that includes reporting information security events and weaknesses. Therefore, the use of lower grade machines for the secure disposal of confidential documents and media could pose a significant information security risk and a potential breach of contract with the clients. The auditor should respond to this information by: conduct a further audit prior to certification. This is in accordance with ISO/IEC 27006:2022 clause 7.4.3, which states that the audit team leader shall report to the certification body any situation that may significantly affect the audit conclusions or the certification decision, and propose any necessary changes to the audit plan. information that has come to light. This is in accordance with ISO/IEC 27006:2022 clause 7.5.2, which states that the audit team leader shall review the audit findings and any other appropriate information collected during the audit to determine the audit conclusions, and to identify any need for a subsequent audit. in accordance with ISO/IEC 27006:2022 clause 7.4.2, which states that the audit team leader shall ensure that the audit is conducted in accordance with the audit plan, and that any changes to the plan are agreed upon and documented.
Topics
Community Discussion
No community discussion yet for this question.